I am using Query widget, one of the queries does not work and prompt credential issues when the service used in the query has joined tables. If there are no joins in the service, the query works fine.
I published the service on our ArcGIS server which is federated with the ArcGIS portal. and I shared the service to everyone in my organization.
Please see the attachment for the problem, seemingly a proxy issue, but it actually has something to do with the join as well.
Any ideas for what is happening?
When I Enabled the Anonymous Authentication for the Web adapter, it started working!
So, what was the cause? the proxy app (dot Net version) can't pass on the windows authentication??
Any ideas are welcome.
There are many possible causes for the security error you're encountering. Some things you may want to look into:
Hope this helps,
to answer your questions:
Yes, I'v used Fiddler and Chrome Developer tools to monitor the traffic, same result: 401 error, invalid credentials. but this only happens when I have joined tables in the service, and only in this circumstance, Web Appbuilder will use proxy:
Yes. the boxes are ticked for "Allow anonymous access to your portal" and "Allow access to the portal through HTTPS only"
No, the application does not require a login, and the services are not secured.
The web adaptor for the GIS server.
What release of Portal for ArcGIS are you using? We've had a couple of issues reported related to using Web AppBuilder for ArcGIS with Portal 10.3 and IWA authentication.
Can you please contact Esri Tech Support so they can help you investigate the issue in more detail.
Hope this helps,
@ Derek Law We are running into an issue with Portal 10.5 and Windows Auth. The token endpoint options are secured, so you get an access denied error when hitting these from code or from the proxy. If I login with my Windows credentials, I can get to the endpoint. The proxy doesn't seem to use credentials when trying to get to the endpoint.
https://server.domain.com/aswa/sharing/generateToken <-- This is protected by windows Auth per documentation for setting up IWA Securing web services with Integrated Windows Authentication—ArcGIS Web Adaptor (IIS) Installation G...
I've tried several things. In the proxy I've tried both App-Login, as well as User-Login.
Below are two snippets from the proxy, take these with a grain of salt, I've tried several variations and the latest code from github. It all seems to boil down to IWA blocking access to the get tokens.
<serverUrl url="https://server.domain.com/aswa/rest/services/" clientId="abc123" clientSecret="99999999" matchAll="true"/>
<serverUrl url="https://server.domain.com/aswa/rest/services/" tokenServiceUri="https://server.domain.com/aswa/tokens/" username="uname" password="password" matchAll="true" />
This seems like a common configuration scenario. Do we have something mis-configured, or is there a known issue?